Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
find-skills
v0.1.0Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express...
⭐ 0· 150·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description match the instructions: the skill's job is to search for and install other skills. However, SKILL.md instructs the agent to run the 'npx' CLI, but the skill metadata lists no required binaries. The omission is inconsistent (npx should be declared as a required binary).
Instruction Scope
Instructions are focused on finding and installing skills and do not ask the agent to read unrelated files or environment variables. However, they explicitly recommend using 'npx skills add <owner/repo@skill> -g -y' (global, non-interactive install). That grants wide discretion to install arbitrary remote code on the user's environment without prompting and lacks guidance about verifying package provenance or reviewing repository contents.
Install Mechanism
This instruction-only skill relies on 'npx' to download and execute code from npm/GitHub at install time. While this is expected for a package-based ecosystem, the skill provides no install spec and does not warn the user about the risks of running npx. Recommending global, non-interactive installs (-g -y) amplifies risk because it will install remote packages into the user's environment without confirmation.
Credentials
The skill requests no environment variables, credentials, or config paths. It does not attempt to access or exfiltrate secrets in SKILL.md.
Persistence & Privilege
The skill itself does not request persistent privileges (always:false) and is user-invocable. However, the instructions encourage global installs (-g), which affect the user's system environment. The skill does not modify other skills or agent configs directly.
What to consider before installing
This skill is coherent with its stated purpose (finding and installing other skills), but it tells the agent to run 'npx' to fetch and globally install arbitrary packages non-interactively (-g -y). npx executes code fetched from remote registries/repos, which can run arbitrary scripts on your machine. Before installing anything suggested by this skill: (1) ensure 'npx' is available and run installs interactively (omit -y) so you can review prompts; (2) prefer not to install globally unless you understand the package and need it; (3) verify the package source on skills.sh or GitHub and read the repository/README; (4) avoid running installs as root; (5) if you want stricter control, ask the agent to show the repository link and install commands and review them yourself. The skill would be safer if SKILL.md declared 'npx' as a required binary and warned explicitly about verifying package provenance.Like a lobster shell, security has layers — review code before you run it.
latestvk976xdh0q551a3tegkztwts4zx833r86
License
MIT-0
Free to use, modify, and redistribute. No attribution required.